Phant0m

Phant0m | Windows 事件日志杀手 Svchost 在所谓的共享服务进程中至关重要，多个服务可以共享一个进程以减少资源消耗。将多个服务分组到单个进程中可以节省计算资源，这一考虑对 NT 设计者来说尤其重要，因为创建 Windows 进程比其他操作系统（例如 Unix 系列）需要更多时间和内存。1 简而言之：在 Windows 操作系统中，svchost.exe 管理服务，服务实际上作为线程在 svchost.exe 下运行。Phant0m 针对事件日志服务，找到负责事件日志服务的进程，检测并终止负责事件日志服务的线程。因此，虽然事件日志服务在系统中看似仍在运行（因为...

MrKaplan - Tool Aimed To Help Red Teamers To Stay Hidden By Clearing Evidence Of Execution

MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. It works by saving information such as the time it ran, snapshot of files and associate each evidence to the related user. This tool is inspired by MoonWalk, a similar tool for Unix machines. You can re...

Phant0m - Windows Event Log Killer

Svchost is essential in the implementation of so-called shared service processes, where a number of services can share a process in order to reduce resource consumption. Grouping multiple services into a single process conserves computing resources, and this consideration was of particular concer...

Invoke-Phant0m - Windows Event Log Killer

This script walks thread stacks of Event Log Service process spesific svchost.exe and identify Event Log Threads to kill Event Log Service Threads. So the system will not be able to collect logs and at the same time the Event Log Service will appear to be running. I have made this script for two...